{"record":{"id":"e34b42d1ead010ed","repo":"puppetlabs/puppet","slug":"could-not-resolve-name-name","errorCode":null,"errorMessage":"Could not resolve name: %{name}","messagePattern":"Could not resolve name: %(.+?)","errorType":"exception","errorClass":"Puppet::Error","httpStatus":null,"severity":"error","filePath":"lib/puppet/util/windows/adsi.rb","lineNumber":194,"sourceCode":"          sids << Puppet::Util::Windows::SID.ads_to_principal(m)\n        rescue Puppet::Util::Windows::Error => e\n          case e.code\n          when Puppet::Util::Windows::SID::ERROR_TRUSTED_RELATIONSHIP_FAILURE, Puppet::Util::Windows::SID::ERROR_TRUSTED_DOMAIN_FAILURE\n            sids << Puppet::Util::Windows::SID.unresolved_principal(m.name, m.sid)\n          else\n            raise e\n          end\n        end\n\n        sids\n      end\n\n      def name_sid_hash(names, allow_unresolved = false)\n        return {} if names.nil? || names.empty?\n\n        sids = names.map do |name|\n          sid = Puppet::Util::Windows::SID.name_to_principal(name, allow_unresolved)\n          raise Puppet::Error, _(\"Could not resolve name: %{name}\") % { name: name } unless sid\n\n          [sid.sid, sid]\n        end\n\n        sids.to_h\n      end\n\n      def delete(name)\n        Puppet::Util::Windows::ADSI.delete(name, @object_class)\n      end\n\n      def exists?(name_or_sid)\n        well_known = false\n        if (sid = Puppet::Util::Windows::SID.name_to_principal(name_or_sid))\n          # Examples of SidType include SidTypeUser, SidTypeGroup\n          if sid.account_type == \"SidType#{@object_class.capitalize}\".to_sym\n            # Check if we're getting back a local user when domain-joined\n            return true unless [:MEMBER_WORKSTATION, :MEMBER_SERVER].include?(Puppet::Util::Windows::ADSI.domain_role)","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/puppetlabs/puppet/blob/e227c27540975c25aa22d533a52424a9d2fc886a/lib/puppet/util/windows/adsi.rb#L176-L212","documentation":"Raised by ADSIObject.name_sid_hash when Windows cannot translate a principal name to a SID: Puppet::Util::Windows::SID.name_to_principal returned nil. Puppet refuses to build permission sets for accounts it cannot resolve unless unresolved SIDs are explicitly permitted.","triggerScenarios":"A Windows group resource listing members that do not exist (typo, deleted account, untrusted domain), or a user resource referencing an unresolvable owner; name_sid_hash(members) during membership management with allow_unresolved left false.","commonSituations":"Group members created later in the run than the group itself; renamed or deleted AD accounts still referenced in manifests; disjoined machines or broken domain trust causing all domain-name resolution to fail.","solutions":["Verify each name on the node (`net user <name>`, `Get-ADGroupMember`) and fix typos or stale references.","Order the catalog so member accounts exist before the group resource (before/require).","Repair or rejoin the domain trust if every domain name fails to resolve.","If calling name_sid_hash directly and dangling SIDs are acceptable, pass allow_unresolved: true."],"exampleFix":"# before\ngroup { 'app-users': members => ['domian\\\\bob'] } # typo in domain\n\n# after\ngroup { 'app-users': members => ['DOMAIN\\\\bob'] }","handlingStrategy":"validation","validationCode":"members.each do |m|\n  principal = Puppet::Util::Windows::SID.name_to_principal(m, true)\n  raise ArgumentError, \"member #{m.inspect} does not resolve to a SID\" if principal.nil?\nend\nPuppet::Util::Windows::ADSI::Group.name_sid_hash(members)","typeGuard":null,"tryCatchPattern":"begin\n  sids = Puppet::Util::Windows::ADSI::Group.name_sid_hash(members)\nrescue Puppet::Error => e\n  raise \"cannot resolve one of #{members.inspect}: #{e.message}\"\nend","preventionTips":["Audit group member lists against AD before catalog runs.","Create member accounts first or add require relationships.","Pass allow_unresolved: true when dangling SIDs are acceptable."],"tags":["puppet","windows","adsi","sid","principal-resolution","groups"],"backgroundTag":"account-lookup-failed","analyzedSha":"e227c27540975c25aa22d533a52424a9d2fc886a","analyzedAt":"2026-08-21T20:49:46.650Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}